CVE-2014-1933 — python-imaging: temporary file name exposure in process list

Back Back to CVE browser

MEDIUM

python-imaging: temporary file name exposure in process list

Published Apr 17, 2014

5.1

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.

Affected products

Red Hat Enterprise Linux 5

python-imaging

Will not fix
Red Hat Enterprise Linux 6

python-imaging

Will not fix
Red Hat Enterprise Linux 7

python-pillow

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	python-imaging	Will not fix	n/a
Red Hat Enterprise Linux 6	python-imaging	Will not fix	n/a
Red Hat Enterprise Linux 7	python-pillow	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

0.45% 0.00451

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00451

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.45% (0.00451)	36.90th	v5 (v2026.06.15)
Jun 15, 2026	0.45% (0.00448)	35.39th	v5 (v2026.06.15)
Mar 17, 2025	0.11% (0.00111)	27.09th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00042)	5.63th	v3 (v2023.03.01)
Mar 6, 2023	1.03% (0.01034)	41.69th	v2 (v2022.01.01)
Sep 10, 2022	1.03% (0.01034)	39.91th	v2 (v2022.01.01)
Apr 1, 2022	1.03% (0.01034)	37.91th	v2 (v2022.01.01)
Feb 4, 2022	1.03% (0.01034)	20.32th	v2 (v2022.01.01)

Weaknesses (3)

CWE-200

Exposure of Sensitive Information

CWE-214

CWE-264

References (13)

http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html
vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2014/02/10/15
mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2014/02/11/1
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/65513
vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-2168-1
vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2014-1933
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1063660
Issue Tracking
https://github.com/advisories/GHSA-r854-96gq-rfg3
Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml
https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7
x_refsource_CONFIRMExploitPatch
https://nvd.nist.gov/vuln/detail/CVE-2014-1933
https://security.gentoo.org/glsa/201612-52
vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2014-1933

Link	Providers	Tags
http://lists.opensuse.org/opensuse-updates/2014-05/msg00002.html		vendor-advisoryx_refsource_SUSE
http://www.openwall.com/lists/oss-security/2014/02/10/15		mailing-listx_refsource_MLIST
http://www.openwall.com/lists/oss-security/2014/02/11/1		mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/65513		vdb-entryx_refsource_BID
http://www.ubuntu.com/usn/USN-2168-1		vendor-advisoryx_refsource_UBUNTU
https://access.redhat.com/security/cve/CVE-2014-1933		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1063660		Issue Tracking
https://github.com/advisories/GHSA-r854-96gq-rfg3		Advisory
https://github.com/pypa/advisory-database/tree/main/vulns/pillow/PYSEC-2014-23.yaml
https://github.com/python-imaging/Pillow/commit/4e9f367dfd3f04c8f5d23f7f759ec12782e10ee7		x_refsource_CONFIRMExploitPatch
https://nvd.nist.gov/vuln/detail/CVE-2014-1933
https://security.gentoo.org/glsa/201612-52		vendor-advisoryx_refsource_GENTOO
https://www.cve.org/CVERecord?id=CVE-2014-1933